Content-Security-Policy - HTTP
ored. report-to fires a securitypolicyviolationevent. other directives block-all-mixed-content prevents loading any assets using http when the page is loaded using https. referrer used to specify information in the referer (sic) header for links away from a page. use the referrer-policy header instead. require-sri-for requires the use of sri for scripts or styles on the page. require-trusted-types-for enforces trusted types at the dom xss injection sinks. trusted-types used to specify an allow-list of trusted types policies. trusted types allows applications to lock down dom xss injection sinks to only accept non-spoofable, typed values in place of strings. upgrade-insecure-requests instructs user agents to treat all of a site's insecure urls (those served over http) as though the...